From 0e8d0e6d1c06ce476868c1ba80aa2ba760d52a77 Mon Sep 17 00:00:00 2001 From: Alex Dunmow Date: Wed, 10 Jun 2026 14:52:35 +0800 Subject: [PATCH] fix(scan-roots): detect consolidated CMS layout (backend/go.mod + web/src) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The old detection keyed on backend/cmd/check-safety, which left the CMS tree when check-safety was hoisted standalone. Since then the CMS resolved as its own backend: web/ was classified as a plugin frontend (strict rules, allowedFrontendFiles bypassed — audit F2's check-5 noise), check 2 demanded RBAC entries for client-only orchestrator protos (audit F3), check 2c flagged a bogus missing go.mod, and checks 3/3b silently SKIPPED. Recognize backend/go.mod + web/src as the CMS shape so backendDir resolves to backend/ and web/src scans under core rules. Co-Authored-By: Claude Fable 5 --- targets.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/targets.go b/targets.go index cc09fdc..f055c76 100644 --- a/targets.go +++ b/targets.go @@ -53,6 +53,15 @@ func resolveScanRoots(target string) (backendDir string, repoRoot string, err er return filepath.Join(absTarget, "backend"), absTarget, nil } + // Consolidated CMS layout — Go module at backend/, frontend at web/src. + // The clause above keys on backend/cmd/check-safety, which left the CMS + // tree when check-safety was hoisted to its own repo; without this one + // the CMS resolves as its own backend, web/ is classified as a plugin + // frontend, and the strict plugin rules bypass allowedFrontendFiles. + if fileExists(filepath.Join(absTarget, "backend", "go.mod")) && dirExists(filepath.Join(absTarget, "web", "src")) { + return filepath.Join(absTarget, "backend"), absTarget, nil + } + if dirExists(filepath.Join(absTarget, "cmd", "check-safety")) { parent := filepath.Clean(filepath.Join(absTarget, "..")) if fileExists(filepath.Join(parent, "buf.yaml")) {